CVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

CVE-2026-68181

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68180

In the Linux kernel, the following vulnerability has been resolved: intelth: fix MSC output device reference leak intelthoutputopen looks up the output device with busfinddevicebydevt, which returns the device with a reference that must be dropped after use. commit 95fc36a234da "intelth: fix devi...

CVE-2026-68342

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68236

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

UBUNTU-CVE-2026-68342

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68146

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize traceparser access In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user inpu...

UBUNTU-CVE-2026-68416

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARNON in addmtddevice error paths When deviceregister or mtdnvmemadd fails inside addmtddevice for a partition, the error handling triggers mtdrelease via putdevice or deviceunregister. mtdrelease calls...

CVE-2026-68133

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

DEBIAN-CVE-2026-68117

In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock-sk on the failed-insert path in tipcskcreate When tipcskcreate fails to insert the new socket tipcskinsert returns non-zero, its error path frees the sk with skfree but leaves sock-sk pointing at the freed object...

EUVD-2026-55602

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARNON in addmtddevice error paths When deviceregister or mtdnvmemadd fails inside addmtddevice for a partition, the error handling triggers mtdrelease via putdevice or deviceunregister. mtdrelease calls...

CVE-2026-68416

Linux kernel CVE-2026-68416 fixes a double-free in add_mtd_device() for MTD partitions and prevents a WARN_ON by overriding dev->type and dev->release before put_device() in error paths. The patch ensures mtd_release() is not called during error handling, avoiding freeing mtd_info twice. Fo...

CVE-2026-68416 mtd: fix double free and WARN_ON in add_mtd_device() error paths

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARNON in addmtddevice error paths When deviceregister or mtdnvmemadd fails inside addmtddevice for a partition, the error handling triggers mtdrelease via putdevice or deviceunregister. mtdrelease calls...

CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68410

Technical details about CVE-2026-68410 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-55596

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68405 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

CVE-2026-68404 wifi: cfg80211: use wiphy work for socket owner autodisconnect

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...

EUVD-2026-55590

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...